fix: review round 7 — fresh-eyes audit fixes (6 agents) + full test suites for every backend change

Fresh-eyes review round with 6 independent agents (money-safety, concurrency,
Square wire parity, security, frontend flow, testing-gaps). Every finding was
independently verified against the code before fixing. All backend changes
now carry full test suites (10+ new tests, each verified to FAIL without its
guard). All 20 packages green, race detector clean.

Money-safety:
- Gift-card purchase refunds no longer create money: manual refunds of a
  no-booking (gift-card purchase) payment are rejected with a clear message
  in the direct handler AND never re-issued by the sweep-resume path
  (processManualPaymentGroup skips them; reconcile-then-fail, no re-issue).
- BuyGiftCard no-client-key fallback: derived deterministically under the
  advisory lock (pending-row reuse fixes lost-response double-charge;
  completed-row sequence advance preserves distinct-purchase collapse fix).
- Terminal completion is never unrecorded: activeTerminalCheckoutID now calls
  recordUntrackedTerminalPayment when a provisional (tmp-) checkout is found
  COMPLETED at Square (previously only marked the row COMPLETED — a lost poll
  left the payment invisible and unrefundable).
- Sweep: provisional tmp- checkout rows are resolved against Square first
  (COMPLETED → record; live → keep guard; NOT_FOUND/CANCELED → fail;
  ambiguous → leave pending) instead of blind-failing a possibly-live
  checkout. recordUntrackedTerminalPayment re-checks the booking status
  (FOR UPDATE) and refuses to record on a cancelled booking, inserting a
  critical_payment_log admin notification instead. Till-sale post-charge
  UPDATE now requires status='pending' (no resurrection of a clawed-back sale).

Frontend (Svelte 5):
- UserPaymentModal keeps CardSelection mounted through processing (bind:this
  ref + Square iframe survive the loyalty/tokenize awaits) — new-card
  payments work again.
- BookingFlow clears the cached nonce/verification pair on any failure (retry
  re-tokenizes fresh; idempotency key retained for dedup); 409 'already paid'
  refetches the booking and reconciles depositPaid so the confirmation gate
  opens; Back button disabled during processing.
- Synchronous double-submit guards on buyGiftCard/redeemGiftCard/submitTip.

Square wire parity (mock vs real):
- processing_fee sign unified (negated at paymentFromSquare; mock agrees).
- SimulateSourceUsed (SOURCE_USED, 400) matches real CreateCard.
- GetCardsOnFile excludes disabled cards (matches ListCards).
- ForcePaymentStatus toggle + tests prove the charge path can't be status-blind.
- CreateCheckout rejects empty device_id (env fallback SQUARE_TERMINAL_DEVICE_ID);
  completed terminal checkout's payment resolvable by id.

Security:
- 2FA attempt-map data race fixed: lastAt is atomic.Int64 (nanos) — eviction
  scan reads race-free; concurrent verify+evict tests under -race.
- Backend refuses to start on weak/placeholder JWT_SECRET_KEY (<32 chars or
  known public placeholders) with openssl rand -hex 32 guidance.
- Dockerfile no longer COPYs .env (secrets injected via compose env_file).
- SabreDAV requires DAV_ADMIN_PASSWORD (no admin/admin default); compose
  fails at config time when missing.

Testing gaps closed (each verified to FAIL without its guard):
- refunded-dedup 409 (CreateBookingPayment), keyed sweep past-retention
  blind-fail, reconcile status-switch (CANCELED/FAILED/APPROVED/PENDING/unknown
  in both by-key and by-id paths), resolveChargeSource Square-failure branches,
  structured 500 / CARD_DECLINED / cancelled-context E2E (row stays pending),
  deriveBookingPaymentIdempotencyKey >45-char truncation, webhook
  findPaymentByDisputeID fallback, clawbackOneTillSale non-gift-card branch,
  dispute.evidence / terminal.checkout dispatch.

Infra:
- local-dev-2.sh fails loudly on port-5432 squatters / docker compose failures
  (previously died silently under ERR_EXIT with hidden output).
- Test harness defaults SQUARE_TERMINAL_DEVICE_ID; money_safety_fixes_test.go
  gained the missing build tag.

Verification: go test -tags test,dev -count=1 -parallel 8 ./... (20/20 ok),
-race clean on 2FA + payments money paths, go build ./... + -tags dev, go vet
clean, svelte-check 0 errors, env-docs gate OK (36 vars), docker compose
config valid.

backend/handlers/payments/payments_r6_review_test.go

@@ -185,20 +185,16 @@ func TestActiveTerminalCheckoutID_ResolvesProvisionalRow(t *testing.T) {
 	require.Equal(t, "failed", status, "the provisional row must be marked failed")
 }
 
-// failingGetCheckoutClient errors on every GetCheckout — if the sweep wrongly
-// resolves a provisional row against Square, the row is left pending (the error
-// is not a terminal checkout state) and the test fails.
-type failingGetCheckoutClient struct {
-	square.SquareClient
-}
-
-func (c *failingGetCheckoutClient) GetCheckout(ctx context.Context, checkoutID string) (*square.PaymentResult, error) {
-	return nil, fmt.Errorf("GetCheckout was called for %s — provisional rows must resolve without a Square round-trip", checkoutID)
-}
-
-// TestSweepStaleTerminalCheckouts_ResolvesProvisionalRowWithoutSquare proves
-// the sweep resolves a stale provisional row to failed without calling Square.
-func TestSweepStaleTerminalCheckouts_ResolvesProvisionalRowWithoutSquare(t *testing.T) {
+// TestSweepStaleTerminalCheckouts_TmpProvisional_ResolvesAgainstSquare locks
+// the H4 fix: a provisional "tmp-" terminal_checkouts row is resolved against
+// Square FIRST, never blind-failed. A hard crash between the row insert and
+// the provisional→real UPDATE can leave a LIVE checkout at Square (created
+// under the idempotency key embedded in the tmp id) while the row still
+// carries the synthetic id — so a tmp- row is NO LONGER provably not live.
+// A tmp- id Square has never seen (NOT_FOUND — the crash happened before the
+// Square call, or the id cannot be resolved) is the expected outcome and is
+// safely resolved to failed.
+func TestSweepStaleTerminalCheckouts_TmpProvisional_ResolvesAgainstSquare(t *testing.T) {
 	ctx, tx := testutils.SetupTestTx(t)
 	userID, bookingID, serviceID := setupTestData(t, ctx, tx)
 
@@ -230,8 +226,12 @@ func TestSweepStaleTerminalCheckouts_ResolvesProvisionalRowWithoutSquare(t *test
 		t.Fatalf("failed to clean leftover stale till sales: %v", err)
 	}
 
+	// A fresh mock holds no checkout under the tmp id → GetCheckout returns
+	// the mock's plain "checkout not found" error (NOT_FOUND), the expected
+	// outcome for a tmp- id that never reached Square → the row is resolved
+	// to failed.
 	origClient := SquareClient
-	SquareClient = &failingGetCheckoutClient{SquareClient: square.NewDevClient()}
+	SquareClient = square.NewDevClient()
 	defer func() { SquareClient = origClient }()
 
 	n, err := SweepStaleTerminalCheckouts(freshCtx)